Skip to content

Commit 56e623e

Browse files
ocofaighocofaigh
authored
fix: cleanup the KMS validation logic + other cleanup (#186)
BREAKING CHANGE: If you were using the legacy input variable `allowlist` to restrict network to a specific IP range, you will need to migrate to using Context Based Restrictions (CBRs) for this. For more info see [Protecting Cloud Databases resources with context-based restrictions](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-cbr&interface=ui)
1 parent 267b152 commit 56e623e

29 files changed

+447
-492
lines changed

‎.secrets.baseline

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"files": "go.sum|^.secrets.baseline$",
44
"lines": null
55
},
6-
"generated_at": "2023-05-05T07:46:50Z",
6+
"generated_at": "2023-05-12T16:19:47Z",
77
"plugins_used": [
88
{
99
"name": "AWSKeyDetector"
@@ -79,10 +79,10 @@
7979
"results": {
8080
"README.md": [
8181
{
82-
"hashed_secret": "8acbd0ff478f744859b92e1251622e4124bceef0",
82+
"hashed_secret": "ff9ee043d85595eb255c05dfe32ece02a53efbb2",
8383
"is_secret": false,
8484
"is_verified": false,
85-
"line_number": 24,
85+
"line_number": 18,
8686
"type": "Secret Keyword",
8787
"verified_result": null
8888
}

‎README.md

Lines changed: 35 additions & 49 deletions
Large diffs are not rendered by default.

‎catalogValidationValues.json.template

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎common-dev-assets

‎examples/basic/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1-
# Basic example
1+
# Basic with read-only replica example
22

33
An end-to-end example that uses the module's default variable values. This example uses the IBM Cloud terraform provider to:
44

55
- Create a new resource group if one is not passed in.
66
- Create a new ICD Postgresql database instance.
7+
- Create a read-only replica of the leader Postgresql database instance. For more info on Read-only Replicas, see [Configuring Read-only Replicas](https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-read-only-replicas)

‎examples/basic/main.tf

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,20 @@ module "postgresql_db" {
2121
region = var.region
2222
resource_tags = var.resource_tags
2323
}
24+
25+
##############################################################################
26+
# ICD postgresql read-only-replica
27+
##############################################################################
28+
29+
module "read_only_replica_postgresql_db" {
30+
count = var.read_only_replicas_count
31+
source = "../.."
32+
resource_group_id = module.resource_group.resource_group_id
33+
name = "${var.prefix}-read-only-replica-${count.index}"
34+
region = var.region
35+
resource_tags = var.resource_tags
36+
pg_version = var.pg_version
37+
remote_leader_crn = module.postgresql_db.crn
38+
member_memory_mb = 2304 # Must be an increment of 384 megabytes. The minimum size of a read-only replica is 2 GB RAM
39+
member_disk_mb = 10752 # Must be an increment of 1536 megabytes. The minimum size of a read-only replica is 10 GB of disk
40+
}

‎examples/basic/variables.tf

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,16 @@ variable "resource_tags" {
3333
description = "Optional list of tags to be added to created resources"
3434
default = []
3535
}
36+
37+
variable "read_only_replicas_count" {
38+
type = number
39+
description = "Number of read-only replicas per leader"
40+
default = 1
41+
validation {
42+
condition = alltrue([
43+
var.read_only_replicas_count >= 1,
44+
var.read_only_replicas_count <= 5
45+
])
46+
error_message = "There is a limit of five read-only replicas per leader"
47+
}
48+
}

‎examples/complete/README.md

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
1-
# Complete example with BYOK encryption, autoscaling, CBR rules, VPE creation and read-only replica provisioning
1+
# Complete example with BYOK encryption, autoscaling, CBR rules, VPE creation, and read-only replica provisioning
22

3-
An end-to-end example that uses the module's default variable values. This example uses the IBM Cloud terraform provider to:
3+
An end-to-end example that does the following:
44

55
- Create a new resource group if one is not passed in.
6-
- Create a new ICD Postgresql database instance with auto-scaling (automatically increase resources) enabled.
76
- Create Key Protect instance with root key.
8-
- Backend encryption using generated Key Protect key.
9-
- Create a Sample VPC.
10-
- Create Context Based Restriction(CBR) to only allow Postgresql to be accessible from the VPC.
11-
- Create a security group and a VPE for the postgres instance
12-
- Create a read-only replica of the leader Postgresql database instance.
7+
- Create a new ICD PostgreSQL database instance with auto-scaling and BYOK encryption enabled.
8+
- Create a Virtual Private Cloud (VPC).
9+
- Create Context Based Restriction (CBR) to only allow Postgresql to be accessible from the VPC.
10+
- Create a security group and a VPE for the PostgreSQL instance.

‎examples/complete/main.tf

Lines changed: 13 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ module "resource_group" {
1414
##############################################################################
1515

1616
module "key_protect_all_inclusive" {
17-
source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-key-protect-all-inclusive.git?ref=v4.0.0"
17+
source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-key-protect-all-inclusive.git?ref=v4.1.0"
1818
resource_group_id = module.resource_group.resource_group_id
1919
# Note: Database instance and Key Protect must be created in the same region when using BYOK
2020
# See https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok
@@ -67,16 +67,18 @@ module "cbr_zone" {
6767
##############################################################################
6868

6969
module "postgresql_db" {
70-
source = "../../"
71-
resource_group_id = module.resource_group.resource_group_id
72-
name = "${var.prefix}-postgres"
73-
region = var.region
74-
service_endpoints = "private"
75-
pg_version = var.pg_version
76-
kms_key_crn = module.key_protect_all_inclusive.keys["icd-pg.${var.prefix}-pg"].crn
77-
resource_tags = var.resource_tags
78-
service_credential_names = var.service_credential_names
79-
auto_scaling = var.auto_scaling
70+
source = "../../"
71+
resource_group_id = module.resource_group.resource_group_id
72+
name = "${var.prefix}-postgres"
73+
region = var.region
74+
service_endpoints = "private"
75+
pg_version = var.pg_version
76+
kms_encryption_enabled = true
77+
kms_key_crn = module.key_protect_all_inclusive.keys["icd-pg.${var.prefix}-pg"].crn
78+
existing_kms_instance_guid = module.key_protect_all_inclusive.key_protect_guid
79+
resource_tags = var.resource_tags
80+
service_credential_names = var.service_credential_names
81+
auto_scaling = var.auto_scaling
8082
cbr_rules = [
8183
{
8284
description = "${var.prefix}-postgres access only from vpc"
@@ -135,21 +137,3 @@ resource "time_sleep" "wait_30_seconds" {
135137
depends_on = [ibm_is_security_group.sg1]
136138
destroy_duration = "30s"
137139
}
138-
139-
##############################################################################
140-
# ICD postgresql read-only-replica
141-
##############################################################################
142-
143-
module "read_only_replica_postgresql_db" {
144-
count = var.read_only_replicas_count
145-
source = "../.."
146-
resource_group_id = module.resource_group.resource_group_id
147-
name = "${var.prefix}-read-only-replica-${count.index}"
148-
region = var.region
149-
resource_tags = var.resource_tags
150-
pg_version = var.pg_version
151-
remote_leader_crn = module.postgresql_db.crn
152-
member_memory_mb = var.replica_member_memory_mb
153-
member_disk_mb = var.replica_member_disk_mb
154-
member_cpu_count = var.replica_member_cpu_count
155-
}

‎examples/complete/variables.tf

Lines changed: 3 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -86,22 +86,8 @@ variable "auto_scaling" {
8686
}
8787
}
8888

89-
variable "read_only_replicas_count" {
90-
type = number
91-
description = "No of read-only replicas per leader"
92-
default = 1
93-
validation {
94-
condition = alltrue([
95-
var.read_only_replicas_count >= 1,
96-
var.read_only_replicas_count <= 5
97-
])
98-
error_message = "There is a limit of five read-only replicas per leader"
99-
}
100-
101-
}
102-
10389
variable "replica_member_memory_mb" {
104-
type = string
90+
type = number
10591
description = "Memory allocation required for postgresql read-only replica database"
10692
default = "3072"
10793
validation {
@@ -114,7 +100,7 @@ variable "replica_member_memory_mb" {
114100
}
115101

116102
variable "replica_member_disk_mb" {
117-
type = string
103+
type = number
118104
description = "Disk allocation required for postgresql read-only replica database"
119105
default = "15360"
120106
validation {
@@ -127,7 +113,7 @@ variable "replica_member_disk_mb" {
127113
}
128114

129115
variable "replica_member_cpu_count" {
130-
type = string
116+
type = number
131117
description = "CPU allocation required for the postgresql read-only replica database"
132118
default = "9"
133119
validation {

0 commit comments

Comments
 (0)